ReNamer:Binary Signatures

ReNamer's Extension rule uses an internal binary signature database for detecting various file extensions.

These signatures in files can be seen only with specialized tools, such as HxD Hex Editor and XVI32 Hex Editor.

The signature list below corresponds to ReNamer 7.3 dated 14 April 2021.

482B424544562050726F6475637473204C6963656E7365204B65792046696C650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001A, KEY, Avira Product Key
FFFE570069006E0064006F0077007300200052006500670069007300740072007900200045006400690074006F0072002000560065007200730069006F006E00200035002E0030003000, REG, Registry Data File 5.00
504B0304????????????????????????????????????????????????????6D696D65747970656170706C69636174696F6E2F657075622B7A6970, EPUB, Open Publication Structure eBook
504B0304????????????????????????????????????????????????????5B436F6E74656E745F54797065735D2E786D6C, DOCX|XLSX|PPTX, Microsoft Office Open XML Format document
1A45DFA3010000000000001F4286810142F7810142F2810442F381084282847765626D42878102428581021853806701, WEBM, WebM Video File
41565020416E7469766972616C2044617461626173652E202863294B6173706572736B79204C616220313939372D32, AVC, Kaspersky Anti-Virus Database
00000002FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000, MAC, MacPaint Bitmap Graphic
1A45DFA3934282886D6174726F736B61428781014285810118538067, MKV, Matroska Video Stream
00000018667479706D7034320000000069736F6D6D703432, MP4, MP4 Video File
000000186674797069736F6D0000000169736F6D61766331, MP4, MP4 Video File
0000001C667479706D7034320000000069736F6D61766331, MP4, MP4 Video File
24464C3240282329205350535320444154412046494C45, SAV, SPSS Data
4C0000000114020000000000C000000000000046, LNK, Windows Shortcut
5B436C6F6E6543445D0D0A56657273696F6E3D, CCD, CloneCD Control File
000100005374616E6461726420414345204442, ACCDB, Access 2007 Database File
000100005374616E64617264204A6574204442, MDB, Microsoft Access Database
4D454449412044455343524950544F52, MDS, Media Descriptor CD Image File
0006156100000002000004D200001000, DB, Netscape Navigator (v4) database file
52494646????????43444441666D7420, CDA, Compact Disc Digital Audio (CD-DA)
52494646????????415649204C495354, AVI, Windows Audio Video Interleave
52494646????????524D494464617461, RMI, Windows Musical Instrument Digital Interface
52494646????????57415645666D7420, WAV, Waveform Audio
89504E470D0A1A0A0000000D49484452, PNG, Portable Network Graphics
50532D58204558450000000000000000, EXE, Playstation Executable
3026B2758E66CF11A6D900AA0062CE6C, WMA|WMV|ASF, Windows Media File
4F67675300020000000000000000, OGG, Ogg Vorbis Audio
??BE000000AB0000000000000000, WRI, Microsoft Write Document
0000000020000000FFFF0000FFFF, RES, Resource File
0000020006040600080000000000, WK1, 1-2-3 Spreadsheet
38425053000100000000000000, PSD, Photoshop Image
??????10123A001019040010, SIS, Symbian OS Installer File
414F4C204665656462616720, BAG, AOL Instant Messenger Buddy List
52494646????????41434F4E, ANI, Windows Animated Cursor
52494646????????57454250, WEBP, Google WebP image file
EFBBBF234558544D33550D0A, M3U8, MP3 Playlist (UTF-8)
110000005343410F000000, PF, Windows Prefetch
4D54686400000006000100, MID, Musical Instrument Digital Interface (MIDI)
5B6175746F72756E5D0D0A, INF, Autorun File
64383A616E6E6F756E6365, TORRENT, BitTorrent Metainfo File
504B0304140008000800, JAR, Java Archive
424547494E3A564D5347, VMG, Nokia Text Message
5B706C61796C6973745D, PLS, Winamp Playlist
2E524D460000001200, RM, RealMedia Streaming Media
67696D702078636620, GZ, GIMP Image
234558544D33550D0A, M3U, MP3 Playlist
D0CF11E0A1B11AE1, DOC|PPT|XLS|MSI|PUB, Microsoft Office or Installer Document
5245474544495434, REG, Windows Registry Data
300000004C664C65, EVT, Windows NT/2000 Event Viewer Log
4D53434600000000, CAB, Microsoft Cabinet File
????????6D6F6F76, MOV, QuickTime Movie
FF4B455942202020, SYS, Keyboard Driver
255044462D312E, PDF, Adobe Portable Document Format
526172211A0700, RAR, WinRAR Compressed Archive
000001BA210001, MPG, MPEG 1 System Stream
52454745444954, REG, Registry Data File
377ABCAF271C, 7Z, 7-Zip Compressed Archive
AC9EBD8F0000, QDF, Quicken Data
D7CDC69A0000, WMF, Windows Metafile
010009000003, WMF, Windows 3.x Metafile
4A4152435300, JAR, JARCS Compressed Archive
424547494E3A, VCF, vCard File
2E7261FD00, RA, RealMedia Streaming Media
7B5C727466, RTF, Rich Text Format File
000001BA44, MPG, ProgDVBR MPEG2 Video
464F524D00, AIFF, Audio Interchange File
49735A21, ISZ, UltraISO ISO Zipped Format
4B4C7377, KEY, Kaspersky Anti-Virus Key
4D502B07, MPC, Musepack Audio
93B20000, LNG, SourceEdit Language Definition
DF0000?F, DCU, Delphi Compiled Unit
00000100, ICO, Windows Icon
01000000, EMF, Extended (Enhanced) Windows Metafile Format
CFAD12FE, DBX, Outlook Express E-mail Folder
47494638, GIF, Graphic Interchange Format
49492A00, TIF, Tagged Image Format
4D4D002A, TIF, Tagged Image Format
00000200, CUR, Windows Cursor
C5D0D3C6, EPS, Encapsulated PostScript
3F5F0300, HLP, Windows Help File
49536328, CAB, Install Shield v5.x or 6.x Compressed File
504B0304, ZIP, ZIP Compressed Archive
E3828596, PWL, Windows Password List
EDABEEDB, RPM, RedHat Package Manager
50533244, SYS, PlayStation 2 Icon
FF575043, WPD, WordPerfect Document
464C5601, FLV, Flash Video
000001, MPG, MPEG Video File
465753, SWF, Macromedia Flash Format
435753, SWF, Shockwave Flash (v5+)
FFD8FF, JPG, JPEG/JIFF Image
1F8B08, GZ, GZip Compressed Archive
1F9D90, Z, UNIX Compressed Archive
494433, MP3, MP3 Audio
FFFB, MP3, MP3 Audio
FFFA, MP3, MP3 Audio
4D5A, EXE|COM|DLL|SYS, Windows Executable
424D, BMP, Windows OS/2 Bitmap Graphics
9501, SKR, PGP Private Keyring
9901, PKR, PGP Public Keyring

For more information regarding known file signatures look here:

• http://mark0.net/soft-trid-e.html (TrID)
• http://filext.com/
• http://file-extension.net/seeker/
• http://www.garykessler.net/library/file_sigs.html